download.lst | 4 +-
external/libwebp/CVE-2023-1999.patch.1 | 52 ----------------------------
external/libwebp/UnpackedTarball_libwebp.mk | 1
3 files changed, 2 insertions(+), 55 deletions(-)
New commits:
commit e99df5f6f9a38d9fa66d515481f43bdc9200c208
Author: Taichi Haradaguchi <20001...@ymail.ne.jp>
AuthorDate: Sat Jul 1 11:56:32 2023 +0900
Commit: Caolán McNamara <caolan.mcnam...@collabora.com>
CommitDate: Mon Jul 3 12:41:56 2023 +0200
upgrade libwebp to 1.3.1
Fixes CVE-2023-1999.
Change-Id: I3d0f5f718242977156729521d14efb1a8d71aee4
Reviewed-on: https://gerrit.libreoffice.org/c/core/+/153819
Tested-by: Jenkins
Reviewed-by: Taichi Haradaguchi <20001...@ymail.ne.jp>
(cherry picked from commit c1fe534ae49e7e97b5965a5d1fbf910598215102)
Reviewed-on: https://gerrit.libreoffice.org/c/core/+/153835
Reviewed-by: Caolán McNamara <caolan.mcnam...@collabora.com>
diff --git a/download.lst b/download.lst
index 6a76dee49b12..ccb3ae574391 100644
--- a/download.lst
+++ b/download.lst
@@ -334,8 +334,8 @@ LIBTOMMATH_TARBALL := ltm-1.0.zip
# three static lines
# so that git cherry-pick
# will not run into conflicts
-LIBWEBP_SHA256SUM :=
64ac4614db292ae8c5aa26de0295bf1623dbb3985054cb656c55e67431def17c
-LIBWEBP_TARBALL := libwebp-1.3.0.tar.gz
+LIBWEBP_SHA256SUM :=
b3779627c2dfd31e3d8c4485962c2efe17785ef975e2be5c8c0c9e6cd3c4ef66
+LIBWEBP_TARBALL := libwebp-1.3.1.tar.gz
# three static lines
# so that git cherry-pick
# will not run into conflicts
diff --git a/external/libwebp/CVE-2023-1999.patch.1
b/external/libwebp/CVE-2023-1999.patch.1
deleted file mode 100644
index 65c2cf75fb79..000000000000
--- a/external/libwebp/CVE-2023-1999.patch.1
+++ /dev/null
@@ -1,52 +0,0 @@
-From a486d800b60d0af4cc0836bf7ed8f21e12974129 Mon Sep 17 00:00:00 2001
-From: James Zern <jz...@google.com>
-Date: Wed, 22 Feb 2023 22:15:47 -0800
-Subject: [PATCH] EncodeAlphaInternal: clear result->bw on error
-
-This avoids a double free should the function fail prior to
-VP8BitWriterInit() and a previous trial result's buffer carried over.
-Previously in ApplyFiltersAndEncode() trial.bw (with a previous
-iteration's buffer) would be freed, followed by best.bw pointing to the
-same buffer.
-
-Since:
-187d379d add a fallback to ALPHA_NO_COMPRESSION
-
-In addition, check the return value of VP8BitWriterInit() in this
-function.
-
-Bug: webp:603
-Change-Id: Ic258381ee26c8c16bc211d157c8153831c8c6910
----
- src/enc/alpha_enc.c | 4 +++-
- 1 file changed, 3 insertions(+), 1 deletion(-)
-
-diff --git a/src/enc/alpha_enc.c b/src/enc/alpha_enc.c
-index f7c02690e3..7d205586fe 100644
---- a/src/enc/alpha_enc.c
-+++ b/src/enc/alpha_enc.c
-@@ -13,6 +13,7 @@
-
- #include <assert.h>
- #include <stdlib.h>
-+#include <string.h>
-
- #include "src/enc/vp8i_enc.h"
- #include "src/dsp/dsp.h"
-@@ -148,6 +149,7 @@ static int EncodeAlphaInternal(const uint8_t* const data,
int width, int height,
- }
- } else {
- VP8LBitWriterWipeOut(&tmp_bw);
-+ memset(&result->bw, 0, sizeof(result->bw));
- return 0;
- }
- }
-@@ -162,7 +164,7 @@ static int EncodeAlphaInternal(const uint8_t* const data,
int width, int height,
- header = method | (filter << 2);
- if (reduce_levels) header |= ALPHA_PREPROCESSED_LEVELS << 4;
-
-- VP8BitWriterInit(&result->bw, ALPHA_HEADER_LEN + output_size);
-+ if (!VP8BitWriterInit(&result->bw, ALPHA_HEADER_LEN + output_size)) ok = 0;
- ok = ok && VP8BitWriterAppend(&result->bw, &header, ALPHA_HEADER_LEN);
- ok = ok && VP8BitWriterAppend(&result->bw, output, output_size);
-
diff --git a/external/libwebp/UnpackedTarball_libwebp.mk
b/external/libwebp/UnpackedTarball_libwebp.mk
index 78761793174e..67f797157717 100644
--- a/external/libwebp/UnpackedTarball_libwebp.mk
+++ b/external/libwebp/UnpackedTarball_libwebp.mk
@@ -15,7 +15,6 @@ $(eval $(call gb_UnpackedTarball_set_patchlevel,libwebp,0))
$(eval $(call gb_UnpackedTarball_add_patches,libwebp,\
external/libwebp/Makefile.vc.patch \
- external/libwebp/CVE-2023-1999.patch.1 \
))
# vim: set noet sw=4 ts=4:
